Search for vulnerabilities
| Vulnerability ID | VCID-xeb2-8f8f-aaaq |
| Aliases |
CVE-2008-5036
|
| Summary | Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 8.4 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Data source | Exploit-DB |
|---|---|
| Date added | Nov. 6, 2008 |
| Description | VideoLAN VLC Media Player < 0.9.6 - '.rt' Local Stack Buffer Overflow |
| Ransomware campaign use | Known |
| Source publication date | Nov. 7, 2008 |
| Exploit type | local |
| Platform | windows |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a stack buffer overflow vulnerability in VideoLAN VLC < 0.9.6. The vulnerability exists in the parsing of RealText subtitle files. In order to exploit this, this module will generate two files: The .mp4 file is used to trick your victim into running. The .rt file is the actual malicious file that triggers the vulnerability, which should be placed under the same directory as the .mp4 file. |
| Note | {}
|
| Ransomware campaign use | Unknown |
| Source publication date | Nov. 5, 2008 |
| Platform | Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/windows/fileformat/vlc_realtext.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.98541 |
| EPSS Score | 0.69531 |
| Published At | May 21, 2025, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| There are no relevant records. | ||||